Home / ubuntu / Questions / 1495051
Accepted
Tom
Asked: 2023-12-06 06:34:17 +0800 CST

SSL error building signed kernel?

  • 772

I'm following the instructions here to build a signed kernel deb package: https://paldan.altervista.org/signed-linux-kernel-deb-creation-how-to/?doing_wp_cron=1701813437.7412788867950439453125

It seems to build the kernel and build and sign the modules. There's lots of this in the output:

  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_fragment.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_hop.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_ipv6.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_mobility.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_routing.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_udp.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_fragment.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/6lowpan/ieee802154_6lowpan.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_hop.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_ipv6.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/ieee802154.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_mobility.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_routing.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/ieee802154_socket.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/6lowpan/nhc_udp.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/mac802154/mac802154.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/6lowpan/ieee802154_6lowpan.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/ceph/libceph.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/batman-adv/batman-adv.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/nfc.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/nci/nci.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/ieee802154_socket.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/nci/nci_spi.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/nci/nci_uart.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/hci/hci.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/net/ieee802154/ieee802154.ko
  INSTALL debian/linux-image/lib/modules/6.6.0-local/kernel/net/nfc/nfc_digital.ko

Then it does something called "ZSTD" - seems to be compressing the modules? There's lots of this:

  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/ansi_cprng.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/tcrypt.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/polyval-generic.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/af_alg.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/algif_hash.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/algif_skcipher.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/algif_rng.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/algif_aead.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/zstd.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/ofb.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/ecc.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/essiv.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/curve25519-generic.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/ecdh_generic.ko.zst
  ZSTD    debian/linux-image/lib/modules/6.6.0-local/kernel/crypto/ecrdsa_generic.ko.zst

Then it tries going back to signing the modules and can't find them:

  DEPMOD  debian/linux-image/lib/modules/6.6.0-local
  INSTALL debian/linux-libc-dev/usr/include
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko] Error 1
make[6]: *** Waiting for unfinished jobs....
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko] Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko] Error 1
make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko] Error 1
make[5]: *** [Makefile:1821: modules_install] Error 2
make[4]: *** [Makefile:2036: run-command] Error 2
make[3]: *** [debian/rules:17: binary-arch] Error 2
dpkg-buildpackage: error: make -f debian/rules binary subprocess returned exit status 2
make[2]: *** [scripts/Makefile.package:146: deb-pkg] Error 2
make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: deb-pkg] Error 2
make: *** [Makefile:234: __sub-make] Error 2

I feel like I must be missing something pretty basic here? What else do I need to do to produce a deb package of a signed custom kernel?

kernel

1 Answers

  1. Best Answer

    For some reason, ZSTD kernel module compression leads to these errors when signing. Not sure if that is a bug. Disabling ZSTD compression fixes it for me. Change the following kernel configuration options to be as follows:

    CONFIG_MODULE_COMPRESS_NONE=y
# CONFIG_MODULE_COMPRESS_ZSTD is not set

    See my answer there for more details: https://stackoverflow.com/questions/76587960/failed-to-install-kernel-modules/77671009#77671009

    • 2